Internal Controls Top SEC’s Agenda

Internal Controls Top SEC’s Agenda

As the deadline for meeting the Public Company Accounting Oversight Board’s Auditing Standard No. 2 fast approaches, the Securities and Exchange Commission said this week it will, if necessary, delay other priorities to make sure that public company management and their auditors get the internal control requirements “right.”

The standard, approved by the SEC on June 17, requires auditors to form an opinion on management’s assessment of a company’s internal controls that, under the Sarbanes-Oxley Act, must be included with financial statements. To form an opinion, auditors now must evaluate and test management’s internal control process, the work performed by others (i.e., internal auditors) and the effectiveness of the controls. For fiscal year-end, accelerated filers must comply by Nov. 15, while nonaccelerated filers have until July 15, 2005.

“Of all the reforms in the act (Sarbanes-Oxley), the internal control requirements may have the largest effect on improving financial accuracy,” said SEC Chief Accountant Donald T. Nicolaisen last month. Speaking at the Sept. 14 Current Developments Under the Sarbanes-Oxley Act Conference, Nicolaisen infused his presentation with what has become the predominant theme of state and federal regulators: strengthening the quality and transparency of the financial reporting process.

For these reasons, he said, the SEC staff is considering whether to recommend the postponement, at least temporarily, of other initiatives, until the Commission is assured that management and their auditors are fully committed to fulfilling their internal control obligations. He advised the audit profession and registrants to “keep the heat” on Section 404—the part of Sarbanes-Oxley that concerns internal controls—so that they have the ability to meet the deadlines.

“We want companies to get (Section) 404 right,” Nicolaisen said. “That takes precedence.”

In a related matter, one day after Nicolaisen spoke, the PCAOB announced that it had adopted amendments to its interim standards that conform them to Auditing Standard No. 2, “An Audit of Internal Control Over Financial Reporting Performed in Conjunction with an Audit of Financial Statements.” Prior to developing its own standards, the PCAOB adopted, in April 2003, interim auditing, attestation and independence standards based on those created by the auditing profession. The amendments will, among other things, “eliminate(ing) potential confusion and inconsistencies in interpretation” between the old and the new standards, the PCAOB said in a press release.

As he discussed the significance of the new internal control requirements, Nicolaisen raised an issue that has been simmering for two years. Since its passage, there has been notable concern publicly registered with the SEC that Sarbanes-Oxley could have an undue effect on smaller-sized public companies. The chief accountant stressed the need for balance on this issue.

“As a general matter, I believe that small business should be expected to adhere to those same standards to the extent that they have like transactions,” Nicolaisen said. “However, the burden to smaller companies can be disproportionate and needs to be appropriately weighed against the protection of investors.”

Concern about trickle-down state legislation that would incorporate Sarbanes-Oxley–type regulations for nonpublic companies has also been expressed in the past. While not directly addressing this issue, Nicolaisen stated his belief that the private sector should consider developing an internal control framework.

During his speech, Nicolaisen departed briefly from his prepared remarks to discuss licensing requirements, emphasizing the importance of continuing professional education. The New York State Society of CPAs publicly supports mandatory CPE for all CPAs, including those in industry.

“I’ve seen too many examples of professional skills fading over time,” Nicolaisen said. “We need to ensure expertise grows with experience.”

In addition to suggesting the consideration of some form of professional competency test that extends beyond the CPA exam, Nicolaisen also noted his belief that the Uniform Accountancy Act “has not worked well enough” to mitigate the differences in licensing conditions from state to state.

Good to Know

Following Nicolaisen, Carol Stacey, chief accountant in the SEC’s Division of Corporation Finance, gave a point-by-point review of the most common questions and problems that her staff encounters.

One area in which the SEC receives many questions is revenue recognition. Stacey said the filings should avoid “generally” recognizing revenue and get specific about the times when revenue is recognized.

The SEC also wants small business filers to take a closer look at their MD&A (Management Discussion and Analysis), refusing the temptation to simply drop in new numbers.

“Get rid of the boilerplate,” Stacey said.

In general, the SEC had been dissatisfied with the quality of the MD&As it was receiving, Stacey said. Last year, the Commission issued an MD&A interpretation, now effective, to assist companies. While the SEC has seen improvement, there needs to be more focus on the analysis side and increased inclusion of forward-looking, trend information. The MD&A should also feature an overview at the front that offers readers the most salient news about the company.

“The CEO knows what is keeping him up at night,” Stacey said. “Shouldn’t investors know?”

Finally, if relevant, the MD&A should include disclosure in the off-balance-sheet section, she added.

Pertaining to this matter, Nicolaisen said that Congress requested of the SEC a study to be issued later this fall that examines issuers’ off-balance-sheet activities—liabilities and assets not accounted for—to give legislators and regulators more insight into the prevalence of these items since Enron and other financial reporting scandals.

The Society’s SEC Practice Committee, chaired by George I. Victor, sponsored the conference. Mitchell J. Mertz and Rita Piazza served as conference cochairs.